{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# T1036.003 - Masquerading: Rename System Utilities",
    "\n",
    "Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>). (Citation: Endgame Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Atomic Tests"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "#Import the Module before running the tests.\n# Checkout Jupyter Notebook at https://github.com/haresudhan/TheAtomicPlaybook to run PS scripts.\nImport-Module /Users/0x6c/AtomicRedTeam/atomics/invoke-atomicredteam/Invoke-AtomicRedTeam.psd1 - Force"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #1 - Masquerading as Windows LSASS process\nCopies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe.\n\nUpon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session\n\n**Supported Platforms:** windows\n#### Attack Commands: Run with `command_prompt`\n```command_prompt\ncopy %SystemRoot%\\System32\\cmd.exe %SystemRoot%\\Temp\\lsass.exe\n%SystemRoot%\\Temp\\lsass.exe /B\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #2 - Masquerading as Linux crond process.\nCopies sh process, renames it as crond, and executes it to masquerade as the cron daemon.\n\nUpon successful execution, sh is renamed to `crond` and executed.\n\n**Supported Platforms:** linux\n#### Attack Commands: Run with `sh`\n```sh\ncp /bin/sh /tmp/crond;\n/tmp/crond\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 2"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #3 - Masquerading - cscript.exe running as notepad.exe\nCopies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe.\n\nUpon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path.\n\n**Supported Platforms:** windows\n#### Attack Commands: Run with `command_prompt`\n```command_prompt\ncopy %SystemRoot%\\System32\\cscript.exe %APPDATA%\\notepad.exe /Y\ncmd.exe /c %APPDATA%\\notepad.exe /B\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 3"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #4 - Masquerading - wscript.exe running as svchost.exe\nCopies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe.\n\nUpon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder\n\n**Supported Platforms:** windows\n#### Attack Commands: Run with `command_prompt`\n```command_prompt\ncopy %SystemRoot%\\System32\\wscript.exe %APPDATA%\\svchost.exe /Y\ncmd.exe /c %APPDATA%\\svchost.exe /B\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 4"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #5 - Masquerading - powershell.exe running as taskhostw.exe\nCopies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe.\n\nUpon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path.\n\n**Supported Platforms:** windows\n#### Attack Commands: Run with `command_prompt`\n```command_prompt\ncopy %windir%\\System32\\windowspowershell\\v1.0\\powershell.exe %APPDATA%\\taskhostw.exe /Y\ncmd.exe /K %APPDATA%\\taskhostw.exe\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 5"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #6 - Masquerading - non-windows exe running as windows exe\nCopies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe\n\nUpon successful execution, powershell will execute T1036.003.exe as svchost.exe from on a non-standard path.\n\n**Supported Platforms:** windows\n#### Dependencies:  Run with `powershell`!\n##### Description: Exe file to copy must exist on disk at specified location (#{inputfile})\n\n##### Check Prereq Commands:\n```powershell\nif (Test-Path PathToAtomicsFolder\\T1036.003\\bin\\T1036.003.exe) {exit 0} else {exit 1}\n\n```\n##### Get Prereq Commands:\n```powershell\nNew-Item -Type Directory (split-path PathToAtomicsFolder\\T1036.003\\bin\\T1036.003.exe) -ErrorAction ignore | Out-Null\nInvoke-WebRequest \"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036.003/bin/T1036.003.exe\" -OutFile \"PathToAtomicsFolder\\T1036.003\\bin\\T1036.003.exe\"\n\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 6 -GetPreReqs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Attack Commands: Run with `powershell`\n```powershell\ncopy PathToAtomicsFolder\\T1036.003\\bin\\T1036.003.exe ($env:TEMP + \"\\svchost.exe\")\n$myT1036_003 = (Start-Process -PassThru -FilePath ($env:TEMP + \"\\svchost.exe\")).Id\nStop-Process -ID $myT1036_003\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 6"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #7 - Masquerading - windows exe running as different windows exe\nCopies a windows exe, renames it as another windows exe, and launches it to masquerade as second windows exe\n\n**Supported Platforms:** windows\n#### Attack Commands: Run with `powershell`\n```powershell\ncopy $env:ComSpec ($env:TEMP + \"\\svchost.exe\")\n$myT1036_003 = (Start-Process -PassThru -FilePath ($env:TEMP + \"\\svchost.exe\")).Id\nStop-Process -ID $myT1036_003\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 7"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #8 - Malicious process Masquerading as LSM.exe\nDetect LSM running from an incorrect directory and an incorrect service account\nThis works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\\ folder.\n\nUpon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path.\n\n**Supported Platforms:** windows\nElevation Required (e.g. root or admin)\n#### Attack Commands: Run with `command_prompt`\n```command_prompt\ncopy C:\\Windows\\System32\\cmd.exe C:\\lsm.exe\nC:\\lsm.exe /c echo T1036.003 > C:\\T1036.003.txt\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 8"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Atomic Test #9 - File Extension Masquerading\ndownload and execute a file masquerading as images or Office files. Upon execution 3 calc instances and 3 vbs windows will be launched.\n\ne.g SOME_LEGIT_NAME.[doc,docx,xls,xlsx,pdf,rtf,png,jpg,etc.].[exe,vbs,js,ps1,etc] (Quartelyreport.docx.exe)\n\n**Supported Platforms:** windows\n#### Attack Commands: Run with `command_prompt`\n```command_prompt\ncopy C:\\Windows\\System32\\calc.exe %temp%\\T1036.003_masquerading.docx.exe /Y\ncopy C:\\Windows\\System32\\calc.exe %temp%\\T1036.003_masquerading.pdf.exe /Y\ncopy C:\\Windows\\System32\\calc.exe %temp%\\T1036.003_masquerading.ps1.exe /Y\ncopy PathToAtomicsFolder\\T1036.003\\src\\T1036.003_masquerading.vbs %temp%\\T1036.003_masquerading.xls.vbs /Y\ncopy PathToAtomicsFolder\\T1036.003\\src\\T1036.003_masquerading.vbs %temp%\\T1036.003_masquerading.xlsx.vbs /Y\ncopy PathToAtomicsFolder\\T1036.003\\src\\T1036.003_masquerading.vbs %temp%\\T1036.003_masquerading.png.vbs /Y\ncopy PathToAtomicsFolder\\T1036.003\\src\\T1036.003_masquerading.ps1 %temp%\\T1036.003_masquerading.doc.ps1 /Y\ncopy PathToAtomicsFolder\\T1036.003\\src\\T1036.003_masquerading.ps1 %temp%\\T1036.003_masquerading.pdf.ps1 /Y\ncopy PathToAtomicsFolder\\T1036.003\\src\\T1036.003_masquerading.ps1 %temp%\\T1036.003_masquerading.rtf.ps1 /Y\n%temp%\\T1036.003_masquerading.docx.exe\n%temp%\\T1036.003_masquerading.pdf.exe\n%temp%\\T1036.003_masquerading.ps1.exe\n%temp%\\T1036.003_masquerading.xls.vbs\n%temp%\\T1036.003_masquerading.xlsx.vbs\n%temp%\\T1036.003_masquerading.png.vbs\nC:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -File %temp%\\T1036.003_masquerading.doc.ps1\nC:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -File %temp%\\T1036.003_masquerading.pdf.ps1\nC:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -File %temp%\\T1036.003_masquerading.rtf.ps1\n```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "Invoke-AtomicTest T1036.003 -TestNumbers 9"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Detection",
    "\n",
    "If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Endgame Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": ".NET (PowerShell)",
   "language": "PowerShell",
   "name": ".net-powershell"
  },
  "language_info": {
   "file_extension": ".ps1",
   "mimetype": "text/x-powershell",
   "name": "PowerShell",
   "pygments_lexer": "powershell",
   "version": "7.0"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}